Manually write out the browserid_common file unescaping URLs.

@ozten, can you see if this works for you?

I am uncomfortable with this change because it means that somebody who can gain access to the admin panel of the site could XSS the users.

fixes #47